Give the phone a selection instead of a card under the list

A long press on a host raised a connect card over the bottom of the list: a
password box, CONNECT, EDIT, MOVE and DELETE. It was the right idea in the wrong
place. It covered rows, it had room for five things and never a sixth, and every
one of them was about exactly one machine — so filing eleven imported hosts under
a group was eleven trips through a form, and there was nowhere to put a sixth
action if anybody wanted one.

A long press now chooses the host it landed on, and the actions move into a bar
across the top of the screen, in the vault header's place rather than beside it.
That is where Android has put them since contextual action bars existed, and it
is the one strip a list can never grow into — but the real reason for it is that
while it is up the screen is unambiguously about the ticked hosts and nothing
else, which is what lets the count in the middle of it mean something. Left to
right: the cross that leaves the mode, the count, the pencil, and a ⋯ holding
Connect, Connect via SFTP, Move to vault, Copy to vault, Change group, Duplicate
and Remove.

A tap still connects and still raises nothing. Once anything is ticked it ticks
and unticks instead, which is what every Android list does and is not merely a
convention worth following: a tap that connected while five machines sat ticked
would open a terminal on top of a selection somebody was halfway through
building. Unticking the last host leaves the mode, so there are two ways out of
it and the cross is only one of them.

Both gestures now read the row from the element under the finger rather than from
the list's selection, and that is a correctness change rather than tidying. A tap
on a group heading moves the selection and the view model bounces it straight back
to whichever host was chosen before — which answered "a host, or nothing" for free
while a tap only ever connected. It stops answering it the moment a tap can tick
one: the heading would tick a machine the user was not pointing at, into a set
they are about to delete.

Three of the seven entries are about one machine and are drawn only for one. A
terminal, a file-transfer session and a form each have no reading over six, so
they are collapsed rather than refused. The other four read better for a count
than without one — it is the reason the set exists — and each of them says
afterwards how many hosts it wrote and how many it left alone. Skipping beats
refusing the whole run: a selection of eleven with one read-only row would
otherwise do nothing at all and then report about the wrong ten.

Copy to vault and Duplicate are new, and the difference between them is what each
can safely carry. A copy crosses a key boundary, so it drops the group and the
tags exactly as a move does — both are items of the vault being left, and a host
arriving with either would point at something the destination does not contain,
resolvable on the machine that sent it and dangling for everybody else. A
duplicate stays in the same keychain, so everything it points at is still there
and it keeps both. Change group is the write dragging a card onto a group already
makes on the desktop, run over a selection; it refuses one spanning two keychains
rather than half-filing it, which is the refusal a drop across that boundary
already makes one host at a time.

Connect via SFTP is the one action that leaves the vault. Which machine is a
decrypted item and so is this object's business; the screen it leads to and the
transfers view model behind it are the shell's — so it is an event, on the same
division SessionOpened already draws for a shell. The host is re-found in that
screen's own copy of the list, because the picker binds to rows in that copy and
handing it the vault's object would select nothing.

What is left of the card is the password box, and only because it had nowhere
else to go: a host that authenticates with a typed password cannot be reached by
a tap alone. That tap now raises a sheet rather than the bar, and the difference
is that a sheet is up only while a question is on screen — the bar was raised by
a long press and stayed, so it was a password box sitting over the list whether or
not anything was being asked. Dismissing it empties the box, which is not tidiness
either: a secret left behind would satisfy the emptiness check that decides
whether to raise the sheet at all, so the next tap would dial with somebody else's
password.

The pencil moving into that bar takes the host editor with it. It was a card in
the list's own row, under the search box and the sync line — twenty controls
sharing a screen with two rows of chrome about the list it had replaced. It is a
page now, and PhoneShell stands all four of its rows down for it, which is what
"opens with all the options" means at 360dp. That needed a second subscription in
that control: two of its flags are questions about the vault rather than about the
shell, and the shell does not forward the vault's notifications.

The ticks are held as entity ids rather than as rows, and written back onto the
rows after every reload. Every row object in the list is replaced on every filter
keystroke and every synchronisation pass, so a set of rows would empty itself once
a minute under somebody choosing what to do with eleven machines. Ids that no
longer resolve are dropped, so a colleague's deletion arriving mid-selection
leaves a count that matches what is on screen.

One caller had to change with it. ConnectToRecent opened the pane about a host,
which was the desktop's drawer and the phone's card; the phone's answer is now a
tick, and nothing on that list means "selected" any more — so arriving with the
host merely selected would be arriving at a screen with nothing to press. Both are
raised together, and the one the head in front of the user does not draw is inert.

docs/manual-checks.md

@@ -952,13 +952,15 @@ closed — which is how a foldable would open to a phone layout until somebody t
 Look at the bottom right of the host list with no host selected.
 
 **Pass:** a filled accent circle, 56×56, clear of the bottom edge and of the last row's text. Then press
-and hold a host so the connect bar rises.
+and hold a host so the action bar rises, and open the ⋯ menu → **Change group**.
 
-**Pass:** the + has moved up with the bar and is not over the CONNECT button.
+**Pass:** the + is gone the moment anything is ticked, and stays gone under the picker that panel raises.
+It comes back when the cross at the left of the bar is pressed.
 
-**Failure means:** the + was anchored to the screen rather than to the list's row. Nothing in the layout
-harness would catch it if it could run — its only fit rule is containment inside the window, never overlap
-between two controls, so a button sitting squarely on top of CONNECT reports clean.
+**Failure means:** a + still drawn over a selection is `ShowsAddButton` no longer reading `IsChoosingHosts`
+— a control that does something, where the something is not what the screen is about. Nothing in the layout
+harness would catch it if it could run: its only fit rule is containment inside the window, never overlap
+between two controls.
 
 ### 8.3 The sheet says what each choice does
 
@@ -1004,7 +1006,7 @@ Add a group with a default SSH key. Add a host with no group and leave AUTHENTIC
 each time)**. Save. Now edit it and choose the group.
 
 **Pass:** the picker gains an **Inherit from group** entry and moves to it. Save, and the host row reads
-`key`, and the connect bar shows a note naming the group rather than a password box.
+`key`. Tap it: it connects without asking for anything, rather than raising the password sheet.
 
 **Failure means:** the picker's "Password (ask each time)" was written as a decision when it was only the
 absence of one, and this host will never use the fleet's key.
@@ -1013,7 +1015,7 @@ absence of one, and this host will never use the fleet's key.
 
 On that same host, set AUTHENTICATION back to **Password (ask each time)** and save.
 
-**Pass:** the connect bar shows a password box again, and it survives a lock and unlock.
+**Pass:** tapping the row raises the password sheet again, and that survives a lock and unlock.
 
 **Failure means:** the fourth state has no storage and the host is inheriting whatever the group says.
 
@@ -1090,60 +1092,101 @@ selection, which this head never sets. That is the exact failure the header-aime
 With only one writable vault, the entry answers on the status line instead and no panel opens. That is the
 intended answer, not a failure.
 
-### 8.14 DELETE under a host is not beside EDIT
+### 8.14 Remove is at the bottom of the menu, below a rule
 
-Press and hold a host so the connect bar rises.
+Press and hold a host so the action bar rises, then open the ⋯.
 
-**Pass:** CONNECT, then EDIT and MOVE side by side, then DELETE full width in the danger colour on a row of
-its own beneath them. On a host with nowhere to move to, MOVE is absent and the row is EDIT alone.
+**Pass:** Connect, Connect via SFTP, Move to vault, Copy to vault, Change group, Duplicate — then a rule,
+then **Remove** in the danger colour. The sheet scrolls if it has to, and Remove is reachable without the
+list underneath being tapped by accident.
 
-Press DELETE.
+Tick a second host and open the ⋯ again.
 
-**Pass:** the question takes the whole bar — no CONNECT, no EDIT, no second DELETE underneath it — and KEEP
-puts them back with the host still there.
+**Pass:** Connect and Connect via SFTP are gone. A terminal and a file session are each about one machine,
+and there is no reading of "connect to these six". The other five are still there.
 
-**Failure means:** a bar that kept its buttons under the question is one where DELETE can be pressed twice,
-the second press landing on whatever the list rebuilt underneath.
+Press Remove.
 
+**Pass:** a question above the list naming the count — "Delete these 2 hosts?" — and KEEP puts the list back
+with both hosts and both ticks still there.
 
-### 8.15 A tap connects, and a long press is what raises the bar · **the one worth the most care**
+**Failure means:** one question per host is `DeletionTarget.ChosenHosts` not being used, and six copies of
+"delete prod-db?" is not a confirmation anybody reads. A question that cleared the ticks on KEEP is a
+selection thrown away for declining to destroy it.
+
+### 8.15 A tap connects, and a long press chooses · **the one worth the most care**
 
 On a host bound to a key or a stored credential — one that needs nothing typed — tap the row once.
 
 **Pass:** it connects, and the terminal takes the screen. **Nothing rises over the list on the way past** —
-no password box, no CONNECT, no EDIT/MOVE/DELETE. Come back to HOSTS: still nothing.
+no password box, no action bar. Come back to HOSTS: still nothing, and no row is marked.
 
 Now press and hold the same row.
 
-**Pass:** the bar comes up, naming that host, with all of it. Press and hold a different row: the bar
-follows to that one rather than staying on the first.
+**Pass:** the header is replaced by a bar carrying ✕, the count `1`, a pencil and a ⋯, and the row itself is
+filled with a tick at its right-hand end. Press and hold a second row: the count reads `2` and the pencil is
+gone.
+
+Tap one of the two.
+
+**Pass:** it unticks rather than connecting. Tap the other: the count reaches zero, the bar goes and the
+vault header comes back.
 
 Now tap a host that authenticates with a **typed password**.
 
-**Pass:** it does not dial. The bar rises with the password box in it and the status line says the host asks
-for a password. Type it and press CONNECT — or tap the row a second time, which is the same thing — and it
-connects.
+**Pass:** it does not dial. A sheet rises from the bottom naming that host, with a password box, the
+remember tick, CONNECT and CANCEL. Type it and press CONNECT — or dismiss the sheet, type nothing, and tap
+the row a second time — and it connects. Dismissing it empties the box.
 
-**Failure means:** a tap that raises the bar is the old behaviour, where choosing a machine put five
-controls over the bottom of the list in the way of the one thing a tap on its name means. A tap that dials
-a password host with an empty box is worse: the connection fails somewhere the user cannot see why. A long
-press that connects means `held` in `HostsScreen.axaml.cs` is not suppressing the `Tapped` that follows a
-hold, so one touch fires both gestures.
+**Failure means:** a tap that connects while rows are ticked is `IsChoosingHosts` not being read in
+`HostsScreen.axaml.cs` — a terminal opened on top of a selection somebody was halfway through building. A
+tap on a group *heading* that ticks a host is worse: it means the handler is reading the list's selection
+rather than the element under the finger, so a machine nobody pointed at has gone into a set about to be
+deleted. A tap that dials a password host with an empty box fails somewhere the user cannot see why. And a
+long press that also connects means `held` is not suppressing the `Tapped` that follows a hold.
 
-### 8.16 The pencil in the header edits the chosen host
+### 8.16 The pencil in the action bar opens a page, not a card
 
-With a host chosen — by a tap that connected, or by a long press — look at the header beside LOCK.
+Tick exactly one host and press the pencil.
 
-**Pass:** a pencil. It opens that host's editor. With nothing chosen there is no pencil at all rather than a
-greyed one, and while an editor is open it is gone.
+**Pass:** the editor takes the **whole screen** — no search box, no sync line, no shells strip, no bottom
+bar — with its own header carrying ←, the title, and a ✓. The ticks are gone: the screen is about one host
+now.
 
-Navigate to Settings and back.
+Fill in a field and press ← .
 
-**Pass:** the pencil is absent on every screen but HOSTS, including Settings and the keychain.
+**Pass:** back on the list with nothing saved, and the boxes cleared for the next time. The system back
+gesture does the same thing.
 
-**Failure means:** a pencil visible over another screen is the `IsHostsShowing` wrapper gone — see
-`PhoneShell.axaml`, which nests the two conditions because Avalonia's bindings have no "and". A pencil that
-stays while the host editor is up is `CanEditSelectedHost` no longer reading `AnEditorIsOpen`.
+Tick two hosts.
+
+**Pass:** no pencil. Editing two machines has no meaning, and the bar collapses the control rather than
+greying it.
+
+**Failure means:** chrome left around the editor is `RefreshChrome` no longer reading the vault's
+`IsEditing` — see `PhoneShell.axaml.cs`, which subscribes to the vault as well as the shell precisely so
+that it can. A pencil beside a count of two is `HasOneChosenHost` not being read.
+
+### 8.17 Connect via SFTP crosses to the files screen with the host already chosen
+
+Tick one host that needs nothing typed and choose **Connect via SFTP** from the ⋯.
+
+**Pass:** the files screen, with that machine already chosen and connecting — not a picker asking which host
+again. The ticks are gone.
+
+Now do the same with a host that authenticates with a typed password.
+
+**Pass:** the files screen with the picker open, that host chosen in it, its own password box beside it, and
+a line saying the host asks for one. It does not dial with an empty box.
+
+Open a bucket first, then try the entry again.
+
+**Pass:** it refuses and says so, and the screen stays on the bucket. There is one file session behind both
+destinations, so switching under a live one would show a screen titled S3 listing an SFTP host's files.
+
+**Failure means:** a picker asking which host is `MainWindowViewModel.OnVaultFilesRequested` failing to find
+the row — that screen keeps its own copy of the host list, so it has to be re-found there by entity id
+rather than handed the vault's object.
 
 ---
 
@@ -1360,14 +1403,14 @@ seriousness here, since this password is typed rather than stored and so is type
 With at least one keychain host and one machine connected to by hand in the log, open Connections with
 nothing running.
 
-**Pass:** tapping the keychain one lands on HOSTS with that host selected **and its connect bar up**.
-Tapping the hand-typed one puts its address back in the box on this screen and leaves the password box
-**empty**. Neither one dials anything on its own.
+**Pass:** tapping the keychain one lands on HOSTS with that host **ticked and the action bar up**, ready
+for CONNECT out of the ⋯. Tapping the hand-typed one puts its address back in the box on this screen and
+leaves the password box **empty**. Neither one dials anything on its own.
 
 **Failure means:** if the hand-typed one navigates to HOSTS, the log entry is carrying a host id it should
 not have. If the password came back, something is storing it — it never was. And if the keychain one arrives
-with the host selected but **no bar**, `ConnectToRecent` is setting the selection rather than opening the
-pane: since 8.15 a selection alone raises nothing, so that is a screen with nothing to press.
+at a list with nothing marked, `ConnectToRecent` is setting the selection rather than going through
+`AskAboutHost`: nothing on that list means "selected" any more, so that is a screen with nothing to press.
 
 ### 11.9 Settings holds the keychain, and back walks out of it